The command ps aux | grep ] will list all the running kernel threads (the kernel threads that are crated by the kernel, and the kernel threads that are crated by someone else).

Is there a way to list the kernel threads that are created by the kernel only?


Kernel threads are always created by the kernel, and they’re always in process group 0, so you can filter on that:

ps -e -o pid,ppid,pgid,args | awk '$3 == 0'

(There doesn’t seem to be a way of filtering on process group id in ps; in theory one could filter on session 0 but ps doesn’t like that.)

You can also look for processes whose parent is kthreadd, the kernel thread dæmon:

ps --pid 2 --ppid 2 -o pid,ppid,pgid,args

(including pid 2 and its children).

  • "Kernel threads are always created by the kernel" By "Kernel" do you mean the kernel and the kernel modules or just the kernel by itself (because I think kthread_create() is used by kernel modules to create kernel threads)? – user343344 Mar 25 at 17:26
  • Yes, both the kernel and kernel modules; I tend not to distinguish them since most modules can be built in, and once loaded, modules are effectively part of the kernel. – Stephen Kitt Mar 25 at 17:50
  • You could perhaps distinguish between threads started by the “core” kernel from those started by modules by looking at etimes in ps. – Stephen Kitt Mar 25 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.